US9161217B2 - Method and system for authenticating in a communication system - Google Patents

Method and system for authenticating in a communication system Download PDF

Info

Publication number
US9161217B2
US9161217B2 US12/720,972 US72097210A US9161217B2 US 9161217 B2 US9161217 B2 US 9161217B2 US 72097210 A US72097210 A US 72097210A US 9161217 B2 US9161217 B2 US 9161217B2
Authority
US
United States
Prior art keywords
authenticator
message
hash value
authentication
aaa server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US12/720,972
Other languages
English (en)
Other versions
US20100232606A1 (en
Inventor
Ji-Cheol Lee
Alper Yegin
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Samsung Electronics Co Ltd
Original Assignee
Samsung Electronics Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Samsung Electronics Co Ltd filed Critical Samsung Electronics Co Ltd
Assigned to SAMSUNG ELECTRONICS CO., LTD. reassignment SAMSUNG ELECTRONICS CO., LTD. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: LEE, JI-CHEOL, YEGIN, ALPER
Publication of US20100232606A1 publication Critical patent/US20100232606A1/en
Application granted granted Critical
Publication of US9161217B2 publication Critical patent/US9161217B2/en
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/162—Implementing security features at a particular protocol layer at the data link layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/08—Access point devices

Definitions

  • aspects of the present invention relate to a method and system for authenticating a Mobile Terminal (MT) in a communication system. More particularly, aspects of the present invention relate to a method and system for relocating an authenticator of an MT without performing a procedure of re-authentication of the MT in a communication system.
  • MT Mobile Terminal
  • a service provider carries out a user authentication procedure to determine subscription or non-subscription for users who intend to use a network service and service provision or non-provision.
  • EAP Extensible Authentication Protocol
  • an MT and an Authentication, Authorization, and Accounting (AAA) server perform an authentication procedure through a serving network of the MT.
  • the authentication procedure is described below with reference to FIG. 1 .
  • the EAP represents a protocol for encapsulating and information to facilitate authentication, such as Message Digest number 5 (MD5), Transport Layer Security (TLS), Secure Remote Password (SRP), and the like.
  • FIG. 1 illustrates a procedure of authenticating an MT in a wireless communication system according to the related art.
  • the MT 100 completes a physical layer attachment with an authenticator 110 .
  • the MT 100 and the authenticator 110 then initiate a procedure of link-layer entry of the MT 100 .
  • the authenticator 110 sends the MT 100 an EAP request message (EAP Request/Link-layer) requesting IDentification (ID) information for authentication of the MT 100 .
  • EAP Request/Link-layer EAP Request/Link-layer
  • IDentification (ID) information for authentication of the MT 100 .
  • the MT 100 and the authenticator 110 exchange a signal through a Base Station (BS) that is located between the MT 100 and the authenticator 110 .
  • BS Base Station
  • the EAP request message is defined here as ‘PKMv2 PKM-REQ/EAP-Transfer’ in the Institute of Electrical and Electronics Engineers (IEEE) 802.16 standard.
  • step 135 the MT 100 sends the authenticator 110 an EAP response message (EAP Response/Link-layer) including its own ID information in response to the EAP request message (EAP Request/Link-layer).
  • EAP response message is defined here as ‘PKM-RSP/EAP-Transfer’ in the IEEE 802.16 standard.
  • the authenticator 110 includes the ID information of the MT 100 included in the EAP response message (EAP Response/Link-layer), in an AAA request message (EAP Response/AAA Request), and sends the AAA request message (EAP Response/AAA Request) to a home AAA server 120 .
  • the AAA server 120 determines an EAP authentication method using the ID information of the MT 100 identified through the AAA request message (EAP Response/AAA Request). In steps 139 and 141 , the AAA server 120 transmits the determined EAP authentication method information to the MT 100 through the authenticator 110 .
  • the MT 100 identifies the EAP authentication method determined by the AAA server 120 .
  • the MT 100 transmits information of the MT 100 necessary for the EAP authentication method to the AAA server 120 through the authenticator 110 .
  • the AAA server 120 , the authenticator 110 , and the MT 100 repeatedly transmit/receive the EAP authentication method information and the information of the MT 100 necessary for the EAP authentication method, in preparation for packet loss.
  • the AAA server 120 determines whether to authenticate the MT 100 using the information of the MT 100 necessary for the EAP authentication method included in an AAA request message (EAP Response/AAA Request) received from the authenticator 110 . If the AAA server 120 is able to authenticate the MT 100 , then in steps 147 and 149 , the AAA server 120 sends an authentication success message to the MT 100 through the authenticator 110 .
  • EAP Response/AAA Request an AAA request message
  • step 151 the MT 100 completes the link-layer entry with the authenticator 110 . If so, then in step 153 , the AAA server 120 starts accounting for the authenticator 110 . Upon being authenticated from an AAA server and succeeding in a link-layer entry through the above authentication procedure, an MT is provided with a network service.
  • the above authentication procedure can have a problem that a delay caused by transmission/reception of a message between an authenticator and an AAA server results in a failure of a network entry of the MT.
  • the MT authenticated from the AAA server moves to a service area of a different network or the authenticator is relocated, the MT should again perform the authentication procedure of FIG. 1 .
  • the MT should again perform the authentication procedure of FIG. 1 .
  • An aspect of the present invention is to address at least the above-mentioned problems and/or disadvantages and to provide at least the advantages described below. Accordingly, an aspect of the present invention is to provide a method and system for reducing a time delay caused by authentication of a Mobile Terminal (MT) in a communication system.
  • MT Mobile Terminal
  • Another aspect of the present invention is to provide a method and system for reducing a time delay caused by authentication of an MT when an authenticator of the MT is relocated in a communication system.
  • a further aspect of the present invention is to provide a method and system for authenticating an MT using an authentication parameter that a different authenticator has previously used for authenticating the MT, in an authenticator of a communication system.
  • a method for authenticating a Mobile Terminal (MT) in a communication system includes, in a first authenticator, sending an authenticator relocation request to a second authenticator for a link-layer entry of an MT that accesses a physical layer, when the second authenticator includes an authentication parameter of the MT, transmitting a hash value for the authentication parameter of the MT, a random parameter 1 , and a random parameter 2 from the second authenticator to the first authenticator according to the authenticator relocation request of the first authenticator, in the first authenticator, transmitting the hash value for the authentication parameter of the MT received from the second authenticator and the random parameter 1 to an Authentication, Authorization, and Accounting (AAA) server, in the AAA server, determining a validity of the hash value for the authentication parameter of the MT received from the first authenticator, and, when the AAA server determines that the hash value for the authentication parameter of the MT is valid transmitting an authentication parameter previously used at the time of authenticating
  • AAA Authentication, Authorization, and Accounting
  • a communication system for authenticating a Mobile Terminal includes a first authenticator, a second authenticator, and an Authentication, Authorization, and Accounting (AAA) server.
  • the first authenticator sends an authenticator relocation request to a second authenticator for a link-layer entry of an MT that accesses a physical layer, and transmits a hash value for an authentication parameter of the MT received from the second authenticator and a random parameter 1 to an Authentication, Authorization, and Accounting (AAA) server.
  • AAA Authentication, Authorization, and Accounting
  • the second authenticator includes an authentication parameter of the MT, and transmits the hash value for the authentication parameter of the MT, the random parameter 1 , and a random parameter 2 to the first authenticator according to the authenticator relocation request of the first authenticator.
  • the AAA server transmits an authentication parameter previously used at the time of authenticating the MT, to the first authenticator.
  • the random parameter 1 represents a parameter for authentication of the first authenticator and the AAA server.
  • FIG. 1 is a ladder diagram illustrating a procedure of authenticating a Mobile Terminal (MT) in a wireless communication system according to the related art
  • FIG. 2 is a diagram illustrating a construction of a wireless communication system according to an exemplary embodiment of the present invention
  • FIG. 3 is a flow diagram illustrating a procedure for authenticating an MT in an authenticator according to an exemplary embodiment of the present invention
  • FIG. 4 is a flow diagram illustrating a procedure for relocating an authenticator of an MT in an Authentication, Authorization, and Accounting (AAA) server according to an exemplary embodiment of the present invention.
  • AAA Authentication, Authorization, and Accounting
  • FIG. 5 is a flow diagram illustrating a procedure for relocating an authenticator of an MT in a wireless communication system according to an exemplary embodiment of the present invention.
  • EAP Extensible Authentication Protocol
  • an authenticator upon receiving a link-layer entry request from an MT, an authenticator performs a procedure of data link entry with the MT using an authentication parameter that a different authenticator has previously used for authenticating the MT.
  • the authentication parameter includes a Master Session Key (MSK) and a lifetime of the MSK.
  • a Previous Authenticator denotes the different authenticator continuing to use the authentication parameter that the different authenticator has previously used for authenticating the MT.
  • the MT and an Authentication, Authorization, and Accounting (AAA) server have performed an authentication procedure by way of the PA during a previous time.
  • the PA includes the authentication parameter of the MT.
  • a wireless communication system is constructed as described below with reference to FIG. 2 in the case of performing authentication between an AAA server and authenticator and an MT.
  • FIG. 2 illustrates a construction of a wireless communication system according to an exemplary embodiment of the present invention.
  • the wireless communication system includes an AAA server 200 , access GateWays (GWs) 210 and 220 , Base Stations (BSs) 212 and 222 , and an MT 230 .
  • the access GWs 210 and 220 may each include authenticators.
  • the MT 230 When the MT 230 accesses the BS 1 212 , the MT 230 performs an authentication procedure with the AAA server 200 through the access GW 1 210 .
  • the MT 230 and the AAA server 200 perform the authentication procedure through an authenticator 1 that is included in the access GW 1 210 .
  • the MT 230 and the AAA server 200 can perform EAP authentication through the authenticator 1 as illustrated in FIG. 1 above.
  • an access GW providing a service to the MT 230 changes from the access GW 1 210 to the access GW 2 220 .
  • an authenticator 2 included in the access GW 2 220 performs an authentication procedure for the MT 230 using an authentication parameter of the MT 230 acquired from the authenticator 1 .
  • the authenticator 2 performs an authentication procedure for the MT 230 as described below with reference to FIG. 3 .
  • the authenticator 2 performs the authentication procedure for the MT 230 using a hash value for the authentication parameter of the MT 230 received from the authenticator 1 .
  • FIG. 3 illustrates a procedure for authenticating an MT in a New Authenticator (NA) according to an exemplary embodiment of the present invention.
  • NA New Authenticator
  • the NA determines whether to perform a procedure of link-layer entry of an MT. For example, the NA determines whether a link-layer entry request signal is received from the MT that completes physical layer attachment.
  • the NA proceeds to step 303 and identifies a Previous Authenticator (PA) of the MT.
  • PA Previous Authenticator
  • the NA can identify the PA through the link-layer entry request signal received from the MT or a handover request signal.
  • the NA may also identify the PA through a position update request signal received from the MT.
  • the NA may also receive information on the PA of the MT from a new BS that the MT accesses.
  • the NA After identifying the PA, the NA proceeds to step 305 and sends a request for authenticator relocation to the PA of the MT. For example, the NA transmits to the PA an authenticator relocation request signal that includes a Media Access Control (MAC) layer address of the MT attempting the link-layer entry and its own IDentifier (ID) information.
  • MAC Media Access Control
  • ID IDentifier
  • the authenticator NA determines whether an authenticator relocation response signal is received from the PA. If the authenticator relocation response signal is received from the PA, the NA proceeds to step 309 and identifies authentication information on the MT in the authenticator relocation response signal.
  • the authentication information on the MT includes a random parameter 1 (PA_Nonce) for authentication of the NA and an AAA server, a random parameter 2 (NA_Nonce) for authentication of the NA and the PA, a hash value (Previous Authenticator Verification Code (PA_VC)) for an authentication parameter of the MT, ID information of the MT, and the like.
  • the random parameter 1 can be given as ‘CMAC_KEY_COUNTER’.
  • the NA After identifying the authentication information on the MT, the NA proceeds to step 311 and transmits to the AAA server the hash value for the authentication parameter of the MT received from the PA. For example, the NA transmits to the AAA server an authentication request signal that includes a hash value for an authentication parameter of an MT, a random parameter 1 , ID information of the MT, its own ID information, etc.
  • the NA determines whether the AAA server accepts its own authentication request through an AAA response signal received from the AAA server. If the AAA server rejects the authentication request of the NA, the NA recognizes that the MT fails in authentication. Accordingly, the NA terminates the procedure according to the exemplary embodiment of the present invention. In this case, the NA can perform EAP authentication on the MT described above with reference to FIG. 1 .
  • the NA proceeds to step 315 and generates a hash value for an authentication parameter included in the AAA response signal.
  • the NA generates the hash value for the authentication parameter included in the AAA response signal using a hash function taking the random parameter 2 received from the PA in step 309 into consideration.
  • the NA may also generate a key for generating a hash value using the authentication parameter included in the AAA response signal and then generate a hash value for the key using the hash function taking the random parameter 2 into consideration.
  • the NA After generating the hash value for the authentication parameter, the NA proceeds to step 317 and transmits the generated hash value for the authentication parameter to the PA. For example, the NA transmits an authenticator relocation complete request signal including the generated hash value for the authentication parameter, to the PA.
  • step 319 the NA determines whether an authenticator relocation complete response signal is received from the PA. If the authenticator relocation complete response signal is not received from the PA during a predetermined time, or an authenticator relocation complete failure signal is received, the NA recognizes that the MT fails in authenticator relocation. Accordingly, the NA terminates the procedure according to the exemplary embodiment of the present invention. In this case, the authenticator can perform the EAP authentication on the MS described above with reference to FIG. 1 .
  • the NA recognizes that the MT succeeds in data link entry. The procedure according to the exemplary embodiment of the present invention then concludes.
  • the NA can authenticate the MT using the authentication parameter of the MT received from the PA.
  • the AAA server can operate as described below with reference to FIG. 4 .
  • FIG. 4 illustrates a procedure for relocating an authenticator of an MT (a previous authenticator) to the NA in an AAA server according to an exemplary embodiment of the present invention.
  • the AAA server determines whether an authentication request signal is received from the NA. If the authentication request signal is received from the NA, the AAA server proceeds to step 403 and identifies authentication information on an MT included in the authentication request signal.
  • the authentication information on the MT includes a hash value for an authentication parameter of the MT, a random parameter 1 , ID information of the MT, ID information of the NA that transmits the authentication request signal, and the like.
  • the random parameter 1 can be given as ‘CMAC_KEY_COUNTER’.
  • the AAA server determines whether to accept an authentication request of the NA using the hash value for the authentication parameter of the MT. For example, the AAA server identifies the authentication parameter previously used at the time of authenticating the MT through the ID information of the MT. The AAA server generates a hash value for the authentication parameter previously used at the time of authenticating the MT, using the random parameter 1 . The AAA server next compares the hash value received from the NA with the generated hash value, and determines whether to accept the authentication request of the NA.
  • the AAA server determines that the hash value received from the NA is invalid, and determines that the AAA server cannot accept the authentication request of the NA. Accordingly, the AAA server proceeds to step 413 and transmits authentication failure information to the NA.
  • the AAA server determines that the hash value received from the NA is valid, and accepts the authentication request of the NA. Accordingly, the AAA server proceeds to step 407 and transmits authentication success information to the NA.
  • the authentication success information includes the authentication parameter that has previously been used at the time of previously authenticating the MT, and address information of the AAA server.
  • the AAA server After transmitting the authentication success information, the AAA server proceeds to step 409 and stops accounting for a PA of the MT. Then, when the MT and the NA complete link-layer entry, the AAA server proceeds to step 411 and starts accounting for the NA having sent the authentication request in step 401 . The AAA server then terminates the procedure according to the exemplary embodiment of the present invention.
  • the AAA server generates the hash value for the authentication parameter previously used at the time of authenticating the MT, using the random parameter 1 .
  • the AAA server can also generate a key for generating a hash value using an authentication parameter previously used at the time of authenticating an MT, generate a hash value for the key using a random parameter 1 , compare a hash value received from the NA with the generated hash value, and determine whether to accept an authentication request of the NA.
  • the AAA server when accepting the authentication request of the NA, transmits the authentication success information and, after that, stops the accounting for the PA. In another exemplary implementation, when accepting the authentication request of the NA, the AAA server can also perform the procedure of transmitting the authentication success information and the procedure of stopping the accounting for the PA of the MT, in parallel. In yet another exemplary implementation, when accepting the authentication request of the NA, the AAA server can also stop the accounting for the PA of the MT and, after that, transmit the authentication success information.
  • the following description is made for a procedure for relocating an authenticator of an MT in a wireless communication system.
  • FIG. 5 illustrates a procedure for relocating an authenticator of an MT in a wireless communication system according to an exemplary embodiment of the present invention.
  • BSs are positioned between an MT 500 and first and second authenticators 510 and 520 , respectively.
  • the second authenticator can be seen as corresponding to the NA discussed above.
  • step 541 an authentication procedure between the MT 500 and a home AAA server 530 is carried out for the MT 500 through the first authenticator 510 .
  • the authentication procedure between the MT 500 and the AAA server 530 succeeds.
  • the MT 500 authenticated from the AAA server 530 moves to a service area of a different BS and performs a physical layer attachment with the second authenticator 520 .
  • the second authenticator 520 sends an authenticator relocation request message (Relocation_Notify) to the first authenticator 510 .
  • the authenticator relocation request message (Relocation_Notify) includes a MAC layer address (MT-MAC@) of the MT 500 and ID information (Authr-ID) of the second authenticator 520 .
  • the second authenticator 520 can identify the first authenticator 510 through a link-layer entry request signal received from the MT 500 or a handover request signal.
  • the second authenticator 520 may also identify the first authenticator 510 through a position update request signal received from the MT 500 .
  • the second authenticator 520 may also receive information on the first authenticator 510 from a new BS that the MT 500 accesses.
  • the second authenticator 520 recognizes the first authenticator 510 as a PA.
  • the first authenticator 510 Upon receiving the authenticator relocation request message (Relocation_Notify) from the second authenticator 520 in step 545 , the first authenticator 510 generates a hash value (PA_VC) for an authentication parameter of the MT 500 .
  • the first authenticator 510 generates the hash value (PA_VC) for the authentication parameter of the MT 500 using a hash function taking a random parameter 1 (PA_Nonce) into consideration.
  • the first authenticator 510 may also generate a key for generating a hash value using the authentication parameter of the MT 500 and then generate a hash value (PA_VC) for the key using the hash function taking the random parameter 1 (PA_Nonce) into consideration.
  • the authentication parameter of the MT 500 represents an authentication parameter that has previously been used at a time when the first authenticator 510 authenticates the MT 500 .
  • the random parameter 1 (PA_Nonce) can be given as ‘CMAC_KEY_COUNTER’.
  • the first authenticator 510 sends the second authenticator 520 an authenticator relocation response message (Relocation_Notify_Rsp).
  • the authenticator relocation message includes the generated hash value (PA_VC).
  • the authenticator relocation response message (Relocation_Notify_Rsp) includes authentication information on the MT 500 , such as the random parameter 1 (PA_Nonce) for authentication of the second authenticator 520 and the AAA server 530 , a random parameter 2 (NA_Nonce) for authentication of the first authenticator 510 and the second authenticator 520 , the hash value (PA_VC) for the authentication parameter of the MT 500 , ID information (USER-ID) of the MT 500 , and the like.
  • the second authenticator 520 identifies the authentication information on the MT 500 in the authenticator relocation response message (Relocation_Notify_Rsp).
  • the authentication information on the MT 500 may include the random parameter 1 (PA_Nonce) included in the authenticator relocation response message (Relocation_Notify_Rsp), the random parameter 2 (NA_Nonce), the hash value (PA_VC) for the authentication parameter of the MT 500 , the ID information (USER-ID) of the MT 500 , and the like.
  • the second authenticator 520 sends the AAA server 530 an AAA request message (RADIUS Access-Request or Diameter WDER) including the hash value (PA_VC) for the authentication parameter of the MT 500 .
  • the AAA request message includes the hash value (PA_VC) for the authentication parameter of the MT 500 , the random parameter 1 (PA_Nonce), the ID information (USER-ID) of the MT 500 , and ID information (Authr-ID) of the second authenticator 520 .
  • the AAA server 530 determines if the hash value (PA_VC) for the authentication parameter of the MT 500 received from the second authenticator 520 is valid. For example, the AAA server 530 identifies the authentication parameter previously used at the time of authenticating the MT 500 , through the ID information (USER-ID) of the MT 500 included in the AAA request message (RADIUS Access-Request or Diameter WDER). The AAA server 530 generates a hash value for the authentication parameter previously used at the time of authenticating the MT 500 , using the random parameter 1 (PA_Nonce) included in the AAA request message (RADIUS Access-Request or Diameter WDER). The AAA server 530 then compares the hash value (PA_VC) received from the second authenticator 520 with the generated hash value to determine whether the hash value (PA_VC) received from the second authenticator 520 is valid.
  • PA_VC hash value
  • the AAA server 530 determines that the hash value (PA_VC) received from the second authenticator 520 is valid. The AAA server 530 then accepts an authentication request of the second authenticator 520 .
  • the AAA server 530 sends the second authenticator 520 an AAA response message (RADIUS Access-Accept or Diameter WDEA) including the authentication parameter (e.g., the MSK) of the MT 500 .
  • the AAA response message includes the authentication parameter (e.g., the MSK) of the MT 500 and address information of the AAA server 530 .
  • the AAA server 530 determines that the hash value (PA_VC) received from the second authenticator 520 is invalid. In this case, the AAA server 530 determines that the AAA server 530 cannot accept the authentication request of the second authenticator 520 . Accordingly, in step 551 , the AAA server 530 sends the second authenticator 520 an AAA response message (RADIUS Access-Accept or Diameter WDEA) including authentication failure information.
  • AAA response message RADIUS Access-Accept or Diameter WDEA
  • the second authenticator 520 determines whether the AAA server 530 accepts authentication through the AAA response message received from the AAA server 530 .
  • the second authenticator 520 When the AAA server 530 accepts the authentication, the second authenticator 520 generates a hash value (NA_VC) for the authentication parameter of the MT 500 included in the AAA response message (RADIUS Access-Accept or Diameter WDEA). For example, the second authenticator 520 generates the hash value (NA_VC) for the authentication parameter received from the AAA server 530 using a hash function taking a random parameter 2 received from the first authenticator 510 into consideration.
  • NA_VC hash value
  • the second authenticator 520 may also generate a key for generating a hash value using the authentication parameter of the MT 500 included in the AAA response message (RADIUS Access-Accept or Diameter WDEA) and then, generate a hash value (NA_VC) for the key using the hash function taking the random parameter 2 received from the first authenticator 510 into consideration.
  • step 553 the second authenticator 520 sends the first authenticator 510 an authenticator relocation complete request message (Relocation_Complete_Req) including the hash value (NA_VC) for the authentication parameter of the MT 500 .
  • Relocation_Complete_Req an authenticator relocation complete request message including the hash value (NA_VC) for the authentication parameter of the MT 500 .
  • the first authenticator 510 determines if the hash value (NA_VC) for the authentication parameter of the MT 500 received from the second authenticator 520 is valid. For example, the first authenticator 510 generates a hash value for its own authentication parameter of the MT 500 using a hash function taking the random parameter 2 transmitted to the second authenticator 520 into consideration. After that, the first authenticator 510 compares the hash value (NA_VC) received from the second authenticator 520 with the generated hash value, thus determining a validity of the hash value (NA_VC) for the authentication parameter of the MT 500 received from the second authenticator 520 .
  • NA_VC hash value
  • the first authenticator 510 determines that the hash value (NA_VC) for the authentication parameter of the MT 500 received from the second authenticator 520 is valid. Accordingly, in step 555 , the first authenticator 510 sends an authenticator relocation complete response message (Relocation_Complete_Rsp) to the second authenticator 520 .
  • the first authenticator 510 When determining that the hash value (NA_VC) for the authentication parameter of the MT 500 received from the second authenticator 520 is valid, the first authenticator 510 recognizes that the second authenticator 520 is authenticated from the AAA server 530 . Accordingly, in step 557 , the first authenticator 510 and the AAA server 530 stop an accounting processor.
  • the second authenticator 520 recognizes that the MT 500 succeeds in data link entry. Accordingly, in step 561 , the second authenticator 520 and the AAA server 530 start an accounting processor.
  • the PA uses the authentication parameter of the MT.
  • the PA can also transmit an authenticator relocation failure signal to an authenticator having sent an authenticator relocation request.
  • exemplary embodiments of the present invention have an advantage of being capable of reducing a time delay caused by EAP authentication, by authenticating an MT using an authentication parameter that a different authenticator has ever used for authenticating the MT in an authenticator of a communication system.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)
US12/720,972 2009-03-10 2010-03-10 Method and system for authenticating in a communication system Active 2031-12-15 US9161217B2 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
KR10-2009-0020318 2009-03-10
KR1020090020318A KR101655264B1 (ko) 2009-03-10 2009-03-10 통신시스템에서 인증 방법 및 시스템

Publications (2)

Publication Number Publication Date
US20100232606A1 US20100232606A1 (en) 2010-09-16
US9161217B2 true US9161217B2 (en) 2015-10-13

Family

ID=42153777

Family Applications (1)

Application Number Title Priority Date Filing Date
US12/720,972 Active 2031-12-15 US9161217B2 (en) 2009-03-10 2010-03-10 Method and system for authenticating in a communication system

Country Status (6)

Country Link
US (1) US9161217B2 (ja)
EP (1) EP2229018B1 (ja)
JP (1) JP5843616B2 (ja)
KR (1) KR101655264B1 (ja)
CN (1) CN102349320B (ja)
WO (1) WO2010104325A2 (ja)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8443431B2 (en) * 2009-10-30 2013-05-14 Alcatel Lucent Authenticator relocation method for WiMAX system
CN102196439B (zh) * 2010-03-17 2016-08-03 中兴通讯股份有限公司 一种处理鉴权器重定位请求的方法及系统
CA2758429C (en) * 2010-11-15 2017-05-30 Research In Motion Limited Cross-component message encryption
US8910261B2 (en) * 2012-09-28 2014-12-09 Alcatel Lucent Radius policy multiple authenticator support
US9509693B2 (en) * 2013-12-19 2016-11-29 Alcatel Lucent Flexible and generalized authentication
KR20160131744A (ko) 2015-05-08 2016-11-16 임용훈 사용자 인증을 위한 장치 및 방법
KR101746598B1 (ko) 2015-09-08 2017-06-13 임용훈 사용자 인증을 위한 장치
WO2016039568A1 (ko) * 2014-09-11 2016-03-17 임용훈 사용자 인증을 위한 장치 및 방법
KR20160150097A (ko) 2016-12-21 2016-12-28 임용훈 사용자 인증을 위한 장치 및 방법

Citations (33)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6151676A (en) * 1997-12-24 2000-11-21 Philips Electronics North America Corporation Administration and utilization of secret fresh random numbers in a networked environment
WO2001024560A1 (en) 1999-09-27 2001-04-05 Simoco International Limited Radio communications
WO2001039538A1 (en) 1999-11-23 2001-05-31 Nokia Corporation Transfer of security association during a mobile terminal handover
US20020012433A1 (en) * 2000-03-31 2002-01-31 Nokia Corporation Authentication in a packet data network
US20020164026A1 (en) * 1999-02-11 2002-11-07 Antti Huima An authentication method
US20030028763A1 (en) * 2001-07-12 2003-02-06 Malinen Jari T. Modular authentication and authorization scheme for internet protocol
US20030056092A1 (en) * 2001-04-18 2003-03-20 Edgett Jeff Steven Method and system for associating a plurality of transaction data records generated in a service access system
EP1322091A1 (en) 2001-12-19 2003-06-25 Canon Kabushiki Kaisha Communication system, server device, client device and method for controlling the same
KR20040009177A (ko) 2002-07-22 2004-01-31 에스케이 텔레콤주식회사 고속 패킷 데이터의 한도관리방법
EP1414262A1 (en) 2002-10-15 2004-04-28 Samsung Electronics Co., Ltd. Authentication method for fast handover in a wireless local area network
KR20040056994A (ko) 2002-12-24 2004-07-01 한국전자통신연구원 초고속 통신 시스템에서 패스트 핸드오프에 의한 트래픽서비스의 제어방법
US20040165551A1 (en) * 2003-02-26 2004-08-26 Govindarajan Krishnamurthi Method of reducing denial-of-service attacks and a system as well as an access router therefor
US20050044365A1 (en) * 2003-08-22 2005-02-24 Nokia Corporation Method of protecting digest authentication and key agreement (AKA) against man-in-the-middle (MITM) attack
US20050117524A1 (en) 2002-11-08 2005-06-02 Samsung Electronics Co., Ltd. Method for performing handoff in wireless network priority
CN1628449A (zh) 2002-06-20 2005-06-15 诺基亚公司 传送计费信息的方法、系统和设备
US20050166043A1 (en) * 2004-01-23 2005-07-28 Nokia Corporation Authentication and authorization in heterogeneous networks
US20050251681A1 (en) * 2004-03-10 2005-11-10 Robles Luis R GSM-like and UMTS-like authentication in a CDMA2000 network environment
US20060002356A1 (en) * 2004-07-01 2006-01-05 Barany Peter A Dynamic assignment of home agent and home address in wireless communications
WO2006021236A1 (en) 2004-08-26 2006-03-02 Ntt Docomo, Inc. Method and apparatus for supporting secure handover
US20060088011A1 (en) * 2004-10-26 2006-04-27 Cisco Technology, Inc. System and method for allocating and distributing end user information in a network environment
US20060171540A1 (en) * 2005-02-03 2006-08-03 Samsung Electronics Co., Ltd. Wireless network system and communication method for external device to temporarily access wireless network
US20060185013A1 (en) * 2003-06-18 2006-08-17 Telefonaktiebolaget Lm Ericsson (Publ) Method, system and apparatus to support hierarchical mobile ip services
US20060233376A1 (en) 2005-04-15 2006-10-19 Nokia Corporation Exchange of key material
WO2006124030A1 (en) 2005-05-16 2006-11-23 Thomson Licensing Secure handoff in a wireless local area network
US20060280305A1 (en) * 2005-06-13 2006-12-14 Nokia Corporation Apparatus, method and computer program product providing mobile node identities in conjunction with authentication preferences in generic bootstrapping architecture (GBA)
US20070060127A1 (en) 2005-07-06 2007-03-15 Nokia Corporation Secure session keys context
JP2007074238A (ja) 2005-09-06 2007-03-22 Kddi Corp ネットワーク認証システム、認証装置、無線端末及びコンピュータプログラム
US20070091843A1 (en) * 2005-10-25 2007-04-26 Cisco Technology, Inc. EAP/SIM authentication for Mobile IP to leverage GSM/SIM authentication infrastructure
US20070118885A1 (en) 2005-11-23 2007-05-24 Elrod Craig T Unique SNiP for use in secure data networking and identity management
US20070250706A1 (en) * 2006-04-20 2007-10-25 Yoshihiro Oba Channel binding mechanism based on parameter binding in key derivation
KR20080050971A (ko) 2006-12-04 2008-06-10 한국전자통신연구원 이종 무선망 연동 시스템에서 로밍에 필요한 인증 방법
US20080137853A1 (en) * 2006-12-08 2008-06-12 Mizikovsky Semyon B Method of providing fresh keys for message authentication
WO2008074366A1 (en) 2006-12-19 2008-06-26 Telefonaktiebolaget Lm Ericsson (Publ) Managing user access in a communications network

Patent Citations (34)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6151676A (en) * 1997-12-24 2000-11-21 Philips Electronics North America Corporation Administration and utilization of secret fresh random numbers in a networked environment
US20020164026A1 (en) * 1999-02-11 2002-11-07 Antti Huima An authentication method
WO2001024560A1 (en) 1999-09-27 2001-04-05 Simoco International Limited Radio communications
WO2001039538A1 (en) 1999-11-23 2001-05-31 Nokia Corporation Transfer of security association during a mobile terminal handover
US20020012433A1 (en) * 2000-03-31 2002-01-31 Nokia Corporation Authentication in a packet data network
US20030056092A1 (en) * 2001-04-18 2003-03-20 Edgett Jeff Steven Method and system for associating a plurality of transaction data records generated in a service access system
US20030028763A1 (en) * 2001-07-12 2003-02-06 Malinen Jari T. Modular authentication and authorization scheme for internet protocol
EP1322091A1 (en) 2001-12-19 2003-06-25 Canon Kabushiki Kaisha Communication system, server device, client device and method for controlling the same
CN1628449A (zh) 2002-06-20 2005-06-15 诺基亚公司 传送计费信息的方法、系统和设备
KR20040009177A (ko) 2002-07-22 2004-01-31 에스케이 텔레콤주식회사 고속 패킷 데이터의 한도관리방법
EP1414262A1 (en) 2002-10-15 2004-04-28 Samsung Electronics Co., Ltd. Authentication method for fast handover in a wireless local area network
US20050117524A1 (en) 2002-11-08 2005-06-02 Samsung Electronics Co., Ltd. Method for performing handoff in wireless network priority
KR20040056994A (ko) 2002-12-24 2004-07-01 한국전자통신연구원 초고속 통신 시스템에서 패스트 핸드오프에 의한 트래픽서비스의 제어방법
US20040165551A1 (en) * 2003-02-26 2004-08-26 Govindarajan Krishnamurthi Method of reducing denial-of-service attacks and a system as well as an access router therefor
US20060185013A1 (en) * 2003-06-18 2006-08-17 Telefonaktiebolaget Lm Ericsson (Publ) Method, system and apparatus to support hierarchical mobile ip services
US20050044365A1 (en) * 2003-08-22 2005-02-24 Nokia Corporation Method of protecting digest authentication and key agreement (AKA) against man-in-the-middle (MITM) attack
US20050166043A1 (en) * 2004-01-23 2005-07-28 Nokia Corporation Authentication and authorization in heterogeneous networks
US20050251681A1 (en) * 2004-03-10 2005-11-10 Robles Luis R GSM-like and UMTS-like authentication in a CDMA2000 network environment
US20060002356A1 (en) * 2004-07-01 2006-01-05 Barany Peter A Dynamic assignment of home agent and home address in wireless communications
WO2006021236A1 (en) 2004-08-26 2006-03-02 Ntt Docomo, Inc. Method and apparatus for supporting secure handover
US20060088011A1 (en) * 2004-10-26 2006-04-27 Cisco Technology, Inc. System and method for allocating and distributing end user information in a network environment
US20060171540A1 (en) * 2005-02-03 2006-08-03 Samsung Electronics Co., Ltd. Wireless network system and communication method for external device to temporarily access wireless network
JP2008536428A (ja) 2005-04-15 2008-09-04 スパイダー ナビゲイションズ エルエルシー 鍵マテリアルの交換
US20060233376A1 (en) 2005-04-15 2006-10-19 Nokia Corporation Exchange of key material
WO2006124030A1 (en) 2005-05-16 2006-11-23 Thomson Licensing Secure handoff in a wireless local area network
US20060280305A1 (en) * 2005-06-13 2006-12-14 Nokia Corporation Apparatus, method and computer program product providing mobile node identities in conjunction with authentication preferences in generic bootstrapping architecture (GBA)
US20070060127A1 (en) 2005-07-06 2007-03-15 Nokia Corporation Secure session keys context
JP2007074238A (ja) 2005-09-06 2007-03-22 Kddi Corp ネットワーク認証システム、認証装置、無線端末及びコンピュータプログラム
US20070091843A1 (en) * 2005-10-25 2007-04-26 Cisco Technology, Inc. EAP/SIM authentication for Mobile IP to leverage GSM/SIM authentication infrastructure
US20070118885A1 (en) 2005-11-23 2007-05-24 Elrod Craig T Unique SNiP for use in secure data networking and identity management
US20070250706A1 (en) * 2006-04-20 2007-10-25 Yoshihiro Oba Channel binding mechanism based on parameter binding in key derivation
KR20080050971A (ko) 2006-12-04 2008-06-10 한국전자통신연구원 이종 무선망 연동 시스템에서 로밍에 필요한 인증 방법
US20080137853A1 (en) * 2006-12-08 2008-06-12 Mizikovsky Semyon B Method of providing fresh keys for message authentication
WO2008074366A1 (en) 2006-12-19 2008-06-26 Telefonaktiebolaget Lm Ericsson (Publ) Managing user access in a communications network

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-Tran) access (Release 8), 3GPP TS 23.401, 3rd Generation Partnership Project (3GPP), Dec. 2008, Sophia Antipolis Valbonne, France.
IEEE P802.11F/D5, Draft Recommended Practice for Multi-Vendor Access Point Interoperability via an Inter-Access Point Protocol Across Distribution Systems Supporting IEEE 802.11 Operation, Jan. 1, 2003, pp. 1-83.
Zaghloul et al., On the Performance of the AAA Systems in 3G Cellular Networks, Jun. 2007, IEEE International Conference on Communications, pp. 2103-2108. *

Also Published As

Publication number Publication date
KR20100101887A (ko) 2010-09-20
EP2229018A1 (en) 2010-09-15
JP5843616B2 (ja) 2016-01-13
US20100232606A1 (en) 2010-09-16
WO2010104325A2 (en) 2010-09-16
EP2229018B1 (en) 2018-06-06
JP2012520601A (ja) 2012-09-06
CN102349320B (zh) 2015-02-04
WO2010104325A3 (en) 2010-12-09
CN102349320A (zh) 2012-02-08
KR101655264B1 (ko) 2016-09-07

Similar Documents

Publication Publication Date Title
US9161217B2 (en) Method and system for authenticating in a communication system
US8385549B2 (en) Fast authentication between heterogeneous wireless networks
KR100762644B1 (ko) Ｗｌａｎ-ｕｍｔｓ 연동망 시스템과 이를 위한 인증 방법
US7231521B2 (en) Scheme for authentication and dynamic key exchange
US9032485B2 (en) Anchor authenticator relocation method and system
US8887251B2 (en) Handover method of mobile terminal between heterogeneous networks
US8140845B2 (en) Scheme for authentication and dynamic key exchange
US9306748B2 (en) Authentication method and apparatus in a communication system
US10477397B2 (en) Method and apparatus for passpoint EAP session tracking
US20080294891A1 (en) Method for Authenticating a Mobile Node in a Communication Network
US20030236980A1 (en) Authentication in a communication system
KR100755394B1 (ko) Ｕｍｔｓ와 무선랜간의 핸드오버 시 ｕｍｔｓ에서의 빠른재인증 방법
KR20110051174A (ko) 사용자 단말 인증 방법과 그 인증 서버 및 사용자 단말
KR100863135B1 (ko) 이동환경에서의 듀얼 인증 방법
US8705734B2 (en) Method and system for authenticating a mobile terminal in a wireless communication system
KR101445459B1 (ko) 인증 방법 및 제 1 인증 엔티티로부터 제 2 인증 엔티티로 사용자에 대한 인증 관계를 전송하기 위한 방법
CN101150472A (zh) Wimax中实现认证的方法、认证服务器和终端
WO2006079953A1 (en) Authentication method and device for use in wireless communication system
US9485652B2 (en) Method and system for managing mobility of mobile station in a mobile communication system using mobile IP
KR100977114B1 (ko) 휴대인터넷 시스템에서 옥내용 기지국을 이용하는휴대인터넷 단말을 위한 재인증 방법 및 그를 위한 옥내용기지국의 인증 방법
WO2017107745A1 (zh) 终端认证方法、装置及系统

Legal Events

Date Code Title Description
AS Assignment

Owner name: SAMSUNG ELECTRONICS CO., LTD., KOREA, REPUBLIC OF

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:LEE, JI-CHEOL;YEGIN, ALPER;REEL/FRAME:024414/0692

Effective date: 20100519

FEPP Fee payment procedure

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

STCF Information on status: patent grant

Free format text: PATENTED CASE

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 4

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 8